Simple web application firewall using .htaccess

#1

Post by maus80 » Wed, Nov 04, 2015, 7:52 PM UTC

Re: Simple web application firewall using .htaccess

#2

Post by pendexgabo » Wed, Nov 04, 2015, 8:12 PM UTC

huge WTF...you can't call that WAF...At least try adding some more rules.

#3

Post by username_potato » Wed, Nov 04, 2015, 8:14 PM UTC

The problem is, the request still hits Apache, so you can still get DDOSed.

A proper WAF will drop requests before they hit the web server software, or even better, before hitting the server at all.

#4

Post by TylerE » Wed, Nov 04, 2015, 8:20 PM UTC

pendexgabo wrote: post #2

huge WTF...you can't call that WAF...At least try adding some more rules.

Hell, .htaccess being ENABLED is borderline WTF on a real production server.

#5

Post by jonathonf » Wed, Nov 04, 2015, 8:34 PM UTC

pendexgabo wrote: post #2

huge WTF...you can't call that WAF...At least try adding some more rules.

I don't think they know what a WAF actually is.

Blocking IP addresses in an .htaccess file? That's literally* what a firewall is for.

*metaphysically?